Kyber

MITRE ATT&CK does not currently catalogue Kyber, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: low. Treat it as orientation, not attribution.

1. T1078.003 Local Accounts Initial AccessPersistencePrivilege EscalationStealth

   What they do: kyber leverages local accounts harvested from credential access to maintain persistence across systems.

   What that means: Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

2. T1059.001 PowerShell Execution

   What they do: kyber executes payloads via PowerShell to automate system reconnaissance and privilege escalation.

   What that means: Adversaries may abuse PowerShell commands and scripts for execution.

3. T1685 Disable or Modify Tools Defense Impairment

   What they do: kyber disables antivirus tools and modifies security utilities to evade detection during execution.

   What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.

4. T1083 File and Directory Discovery Discovery

   What they do: kyber uses file and directory discovery to enumerate critical assets and shadow copies before encryption.

   What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

5. T1560.001 Archive via Utility Collection

   What they do: kyber archives sensitive data via utility commands prior to exfiltration for extortion leverage.

   What that means: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.

6. T1486 Data Encrypted for Impact Impact

   What they do: kyber encrypts victim files using strong symmetric cryptography to maximize impact and ransom demand.

   What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

7. T1490 Inhibit System Recovery Impact

   What they do: kyber inhibits system recovery by destroying Volume Shadow Copies and disabling backup restoration paths.

   What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

8. T1529 System Shutdown/Reboot Impact

   What they do: kyber forces system shutdowns and reboots to disrupt operational continuity and enforcement responses.

   What that means: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.

The note this group leaves on a compromised machine. Click a filename to read it.

/
#  Hello, if you are seeing this then you have been attacked by Kyber Ransomware.
\

 <=> Your files are encrypted with the AES-256-CTR algorithm.
     >--  (Explanation) https://en.wikipedia.org/wiki/Advanced_Encryption_Standard

 <=> Two asymmetric algorithms X25519 and Kyber1024 were used for key generation.
     >--  (Explanation) https://en.wikipedia.org/wiki/Curve25519
     >--  (Explanation) https://en.wikipedia.org/wiki/Kyber

 <=> Keys are created from several random sources, so do not hope that you will return the files without our help
     >--  (Explanation) https://en.wikipedia.org/wiki//dev/random
     >--  (Explanation) https://en.wikipedia.org/wiki/RDRAND
     >--  (Explanation) https://en.wikipedia.org/wiki/HKDF

(??WE HAVE A FLASH DRIVE WITH BACKUPS ON THE ADMIN'S NECK??)
>========================================================================================
> In addition to encrypting files, a lot of data has been downloaded from your network.
> If you don't write to us, within a week or two your name will end up on our 
> blog with example of important data.
>========================================================================================

(??CAN WE TRUST HACKERS??)
>========================================================================================
> If you come to our chat room, you can count on free decryption for three small files.
> and examples of the downloaded data.
>========================================================================================

(??WE DON'T HAVE VALUABLE DATA??)
>========================================================================================
> We take a responsible approach to doing our job.
> We have probably downloaded a lot of personal information from your servers, and could 
> cause you HUGE problems by publishing it.
# Documents such as payroll, statements, contracts and others may contain valuable data, 
# the publication of which could lead to lawsuits.
>========================================================================================

(??WILL THE POLICE HELP??)
>========================================================================================
> DO NOT try to call the police as they will not save you from 
> publishing your data, nor will they help you get your files back, 
> they will only ban you from paying.
>========================================================================================

(??WHAT IF I TRIED TO TRICK YOU???)
>========================================================================================
> DO NOT modify the files, you may damage them and make it so 
> we can't help you.
>========================================================================================

(??WHAT ABOUT THE ANONYMITY??)
>========================================================================================
> We create unique links to anonymous chat for each company. 
> you don't have to worry, all the details of our deal will be kept secret.
> We also have alternative ways to contact us if you are worried and do 
> not want to write in the panel.
>========================================================================================

HOW TO CONTACT US:
  <=> Download Tor Browser (https://www.torproject.org/download)
  <=> Open it
  <=> Follow this link: http://mlnmlnnrdhcaddwll4zqvfd2vyqsgtgj473gjoehwna2v4sizdukheyd.onion/chat/[snip] 
  (Also maybe you would like to visit our blog? Don't be shy!)
  <=> Blog: http://kyblogtz6k3jtxnjjvluee5ec4g3zcnvyvbgsnq5thumphmqidkt7xid.onion

Ransom-note text from RansomLook, licensed CC BY 4.0.